fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/session_registry.cpp

@@ -3,6 +3,7 @@
 #ifdef VOICECAT_HAS_NET
 
 #include <atomic>
+#include <chrono>
 #include <mutex>
 #include <shared_mutex>
 
@@ -202,6 +203,22 @@ void SessionRegistry::broadcast_unlocked(const voicecat::v1::Envelope& env,
     }
 }
 
+std::vector<std::shared_ptr<ConnSession>> SessionRegistry::find_stale_sessions(
+    int64_t max_age_ms) const {
+    std::shared_lock lk(mu_);
+    auto now_ms = std::chrono::duration_cast<std::chrono::milliseconds>(
+        std::chrono::steady_clock::now().time_since_epoch()).count();
+    std::vector<std::shared_ptr<ConnSession>> stale;
+    for (auto& [sid, weak] : sessions_) {
+        auto sess = weak.lock();
+        if (!sess) continue;
+        int64_t seen = sess->last_seen_ms();
+        if (seen == 0) continue;  // not yet initialized — skip (shouldn't happen after begin())
+        if (now_ms - seen > max_age_ms) stale.push_back(sess);
+    }
+    return stale;
+}
+
 // ── Permissions ───────────────────────────────────────────────────────────────
 
 void SessionRegistry::set_session_permissions(uint64_t session_id,
@@ -253,6 +270,11 @@ bool SessionRegistry::kick_user(uint32_t user_id, const std::string& reason) {
     return true;
 }
 
+void SessionRegistry::broadcast_left(uint32_t user_id, const std::string& reason) {
+    std::shared_lock lk(mu_);
+    broadcast_unlocked(make_left_event(user_id, reason), /*exclude*/ 0);
+}
+
 bool SessionRegistry::ban_user(uint32_t user_id, const std::string& reason, int64_t expires_at) {
     {
         std::unique_lock lk(mu_);